High level conclusions

Fuzzers reach 53.51% code coverage.

Fuzzer multi_surface_fuzzer is blocked:

The runtime code coverage of multi_surface_fuzzer covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzer raster_fuzzer is blocked:

The runtime code coverage of raster_fuzzer covers 0.0% of its statically reachable code. This means there is some place that blocks the fuzzer to continue exploring more code at run time.

Fuzzers reach 26.45% of cyclomatic complexity.

Fuzzers reach 26.60% of all functions.

Reachability and coverage overview

Functions statically reachable by fuzzers

934 / 3511

Cyclomatic complexity statically reachable by fuzzers

5625 / 21266

Runtime code coverage of functions

1879 / 3511

Warning: The number of runtime covered functions are larger than the number of reachable functions. This means that Fuzz Introspector found there are more functions covered at runtime than what is considered reachable based on the static analysis. This is a limitation in the analysis as anything covered at runtime is by definition reachable by the fuzzers.
This is likely due to a limitation in the static analysis. In this case, the count of functions covered at runtime is the true value, which means this is what should be considered "achieved" by the fuzzer.

Use the project functions table below to query all functions that were not covered at runtime.

The following table shows data about each function in the project. The functions included in this table correspond to all functions that exist in the executables of the fuzzers. As such, there may be functions that are from third-party libraries.

For further technical details on the meaning of columns in the below table, please see the Glossary .

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

Fuzzer: raster_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	343	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	343	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
342	0	EP	call site: 00000	cairo_image_surface_create_from_png

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

173

Reachable functions

173

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/raster_fuzzer.c	3
fuzz/fuzzer_temp_file.h	2
cairo/_builddir/..cairo-png.c	10
cairo/_builddir/..cairo-misc.c	4
cairo/_builddir/..cairo-surface.c	17
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-output-stream.c	9
cairo/_builddir/..cairo-array.c	11
cairo/_builddir/..cairo-image-surface.c	13
cairo/_builddir/..cairo-device.c	5
cairo/_builddir/..cairo-matrix.c	2
cairo/_builddir/..cairo-list-inline.h	5
cairo/_builddir/..cairo-image-compositor.c	2
cairo/_builddir/..cairo-traps-compositor.c	1
cairo/_builddir/..cairo-shape-mask-compositor.c	1
cairo/_builddir/..cairo-spans-compositor.c	1
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	2
cairo/_builddir/..cairo-pattern.c	7
cairo/_builddir/..cairo-font-options.c	1
cairo/_builddir/..cairo-raster-source-pattern.c	3
cairo/_builddir/..cairo-freed-pool-private.h	2
cairo/_builddir/..cairo-freed-pool.c	2
cairo/_builddir/..cairo-surface-inline.h	1
cairo/_builddir/..cairo-hash.c	5
cairo/_builddir/..cairo.c	6
cairo/_builddir/..cairo-image-surface-inline.h	1
cairo/_builddir/..cairo-color.c	1

Fuzzer: surface_write_png_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	140	37.3%
gold	[1:9]	27	7.19%
yellow	[10:29]	13	3.46%
greenyellow	[30:49]	5	1.33%
lawngreen	50+	190	50.6%
All colors	375	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
16	206	cairo_surface_destroy	call site: 00206	cairo_pattern_destroy
7	95	cairo_format_stride_for_width	call site: 00095	_cairo_surface_create_in_error
7	182	_cairo_surface_has_snapshots	call site: 00182	_cairo_surface_detach_snapshot
7	314	_cairo_image_surface_coerce_to_format	call site: 00314	cairo_image_surface_create
6	196	_cairo_surface_finish	call site: 00196	_cairo_damage_destroy
5	25	_cairo_error	call site: 00025	_cairo_surface_create_in_error
5	226	cairo_surface_destroy	call site: 00226	_cairo_surface_detach_snapshot
5	258	_cairo_hash_table_insert	call site: 00258	_cairo_hash_table_lookup_unique_key
4	116	cairo_image_surface_create_for_data	call site: 00116	_cairo_surface_create_in_error
4	295	cairo_surface_write_to_png	call site: 00295	_cairo_error
4	302	_cairo_surface_acquire_source_image	call site: 00302	_cairo_surface_set_error
3	8	fuzzer_get_tmpfile	call site: 00008	perror

Runtime coverage analysis

Covered functions

109

Functions that are reachable but not covered

86

Reachable functions

184

Percentage of reachable functions covered

53.26%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/surface_write_png_fuzzer.c	1
fuzz/fuzzer_temp_file.h	2
cairo/_builddir/..cairo-png.c	19
cairo/_builddir/..cairo-misc.c	4
cairo/_builddir/..cairo-surface.c	19
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-output-stream.c	9
cairo/_builddir/..cairo-array.c	11
cairo/_builddir/..cairo-image-surface.c	18
cairo/_builddir/..cairo-device.c	5
cairo/_builddir/..cairo-matrix.c	2
cairo/_builddir/..cairo-list-inline.h	5
cairo/_builddir/..cairo-image-compositor.c	2
cairo/_builddir/..cairo-traps-compositor.c	1
cairo/_builddir/..cairo-shape-mask-compositor.c	1
cairo/_builddir/..cairo-spans-compositor.c	1
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	2
cairo/_builddir/..cairo-pattern.c	2
cairo/_builddir/..cairo-font-options.c	1
cairo/_builddir/..cairo-raster-source-pattern.c	1
cairo/_builddir/..cairo-freed-pool-private.h	1
cairo/_builddir/..cairo-freed-pool.c	1
cairo/_builddir/..cairo-surface-inline.h	1
cairo/_builddir/..cairo-hash.c	5
cairo/_builddir/..cairo-image-surface-inline.h	1
cairo/_builddir/..cairo-surface-snapshot-inline.h	1

Fuzzer: text_glyphs_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	272	59.7%
gold	[1:9]	118	25.9%
yellow	[10:29]	11	2.41%
greenyellow	[30:49]	43	9.45%
lawngreen	50+	11	2.41%
All colors	455	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
96	317	_cairo_utf8_to_ucs4	call site: 00317	cairo_scaled_font_text_to_glyphs_internal_cached
27	414	cairo_surface_reference	call site: 00414	cairo_scaled_font_text_to_glyphs_internal_uncached
13	208	cairo_pattern_destroy	call site: 00208	_cairo_pattern_fini
10	298	cairo_text_extents	call site: 00298	_cairo_scaled_font_create_in_error
9	287	LLVMFuzzerTestOneInput	call site: 00287	_cairo_error
7	95	cairo_format_stride_for_width	call site: 00095	_cairo_surface_create_in_error
6	196	_cairo_surface_finish	call site: 00196	_cairo_damage_destroy
6	444	LLVMFuzzerTestOneInput	call site: 00444	_cairo_validate_text_clusters
5	25	_cairo_error	call site: 00025	_cairo_surface_create_in_error
5	226	cairo_surface_destroy	call site: 00226	_cairo_surface_detach_snapshot
5	258	_cairo_hash_table_insert	call site: 00258	_cairo_hash_table_lookup_unique_key
4	75	read_png	call site: 00075	png_set_tRNS_to_alpha

Runtime coverage analysis

Covered functions

205

Functions that are reachable but not covered

112

Reachable functions

209

Percentage of reachable functions covered

46.41%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/text_glyphs_fuzzer.c	1
fuzz/fuzzer_temp_file.h	2
cairo/_builddir/..cairo-png.c	10
cairo/_builddir/..cairo-misc.c	9
cairo/_builddir/..cairo-surface.c	18
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-output-stream.c	9
cairo/_builddir/..cairo-array.c	14
cairo/_builddir/..cairo-image-surface.c	11
cairo/_builddir/..cairo-device.c	5
cairo/_builddir/..cairo-matrix.c	2
cairo/_builddir/..cairo-list-inline.h	7
cairo/_builddir/..cairo-image-compositor.c	3
cairo/_builddir/..cairo-traps-compositor.c	1
cairo/_builddir/..cairo-shape-mask-compositor.c	1
cairo/_builddir/..cairo-spans-compositor.c	1
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	2
cairo/_builddir/..cairo-pattern.c	2
cairo/_builddir/..cairo-font-options.c	1
cairo/_builddir/..cairo-raster-source-pattern.c	1
cairo/_builddir/..cairo-freed-pool-private.h	1
cairo/_builddir/..cairo-freed-pool.c	1
cairo/_builddir/..cairo-surface-inline.h	1
cairo/_builddir/..cairo-hash.c	8
cairo/_builddir/..cairo.c	8
cairo/_builddir/..cairo-scaled-font.c	15
cairo/_builddir/..cairo-unicode.c	4
cairo/_builddir/..cairo-color.c	2
cairo/_builddir/..cairo-cache.c	7
cairo/_builddir/..cairo-path-fixed.c	3

Fuzzer: svg-render-fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	783	44.6%
gold	[1:9]	27	1.53%
yellow	[10:29]	17	0.96%
greenyellow	[30:49]	7	0.39%
lawngreen	50+	920	52.4%
All colors	1754	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
140	1539	cairo_surface_finish	call site: 01539	_cairo_surface_show_text_glyphs
67	1413	_cairo_font_options_init_copy	call site: 01413	cairo_scaled_font_create
41	608	_cairo_box_from_rectangle	call site: 00608	_cairo_recording_surface_create_bbtree
37	1486	cairo_scaled_font_destroy	call site: 01486	_cairo_scaled_font_fini_internal
36	1225	_gradient_is_clear	call site: 01225	_cairo_gradient_pattern_box_to_parameter
30	1349	_cairo_recording_surface_replay_internal	call site: 01349	_cairo_surface_wrapper_fill_stroke
26	1173	_cairo_clip_intersect_path	call site: 01173	_cairo_clip_intersect_clip_path_transformed
23	1038	_cairo_path_fixed_fill_to_polygon	call site: 01038	_cairo_filler_ra_move_to
21	1702	cairo_pattern_set_matrix	call site: 01702	_cairo_recording_surface_merge_source_attributes
18	1321	_cairo_surface_wrapper_mask	call site: 01321	_cairo_surface_wrapper_stroke
12	165	parse_svg	call site: 00165	_cairo_isspace
12	322	cairo_pattern_destroy	call site: 00322	cairo_device_destroy

Runtime coverage analysis

Covered functions

988

Functions that are reachable but not covered

167

Reachable functions

562

Percentage of reachable functions covered

70.28%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
cairo/test/svg/fuzzer/svg-render-fuzzer.c	1
cairo/_builddir/..cairo-image-surface.c	10
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-surface.c	31
cairo/_builddir/..cairo-device.c	5
cairo/_builddir/..cairo-array.c	13
cairo/_builddir/..cairo-matrix.c	19
cairo/_builddir/..cairo-list-inline.h	7
cairo/_builddir/..cairo-image-compositor.c	3
cairo/_builddir/..cairo-traps-compositor.c	1
cairo/_builddir/..cairo-shape-mask-compositor.c	1
cairo/_builddir/..cairo-spans-compositor.c	1
cairo/_builddir/..cairo.c	15
cairo/_builddir/..cairo-svg-glyph-render.c	41
cairo/_builddir/..cairo-pattern.c	32
cairo/_builddir/..cairo-color.c	2
cairo/_builddir/..cairo-freed-pool-private.h	2
cairo/_builddir/..cairo-freed-pool.c	2
cairo/_builddir/..cairo-hash.c	9
cairo/_builddir/..cairo-ctype-inline.h	1
cairo/_builddir/..cairo-cache.c	8
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	4
cairo/_builddir/..cairo-font-options.c	7
cairo/_builddir/..cairo-surface-inline.h	2
cairo/_builddir/..cairo-raster-source-pattern.c	3
cairo/_builddir/..cairo-misc.c	4
cairo/_builddir/..cairo-recording-surface.c	22
cairo/_builddir/..cairo-path.c	1
cairo/_builddir/..cairo-recording-surface-inline.h	1
cairo/_builddir/..cairo-analysis-surface.c	6
cairo/_builddir/..cairoint.h	7
cairo/_builddir/..cairo-surface-wrapper.c	18
cairo/_builddir/..cairo-rectangle.c	7
cairo/_builddir/..cairo-clip.c	17
cairo/_builddir/..cairo-clip-inline.h	2
cairo/_builddir/..cairo-fixed-private.h	14
cairo/_builddir/..cairo-combsort-inline.h	1
cairo/_builddir/..cairo-analysis-surface-private.h	1
cairo/_builddir/..cairo-path-fixed.c	38
cairo/_builddir/..cairo-clip-boxes.c	6
cairo/_builddir/..cairo-box-inline.h	5
cairo/_builddir/..cairo-boxes.c	9
cairo/_builddir/..cairo-slope-private.h	3
cairo/_builddir/..cairo-path-bounds.c	8
cairo/_builddir/..cairo-spline.c	9
cairo/_builddir/..cairo-path-fixed-private.h	2
cairo/_builddir/..cairo-path-fill.c	12
cairo/_builddir/..cairo-bentley-ottmann-rectangular.c	20
cairo/_builddir/..cairo-traps.c	2
cairo/_builddir/..cairo-polygon.c	8
cairo/_builddir/..cairo-wideint-private.h	1
cairo/_builddir/..cairo-bentley-ottmann-rectilinear.c	14
cairo/_builddir/..cairo-boxes-intersect.c	23
cairo/_builddir/..cairo-surface-snapshot-inline.h	2
cairo/_builddir/..cairo-surface-wrapper-private.h	1
cairo/_builddir/..cairo-scaled-font.c	33
cairo/_builddir/..cairo-font-face.c	3

Fuzzer: font_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	366	43.6%
gold	[1:9]	22	2.62%
yellow	[10:29]	16	1.90%
greenyellow	[30:49]	4	0.47%
lawngreen	50+	431	51.3%
All colors	839	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
36	285	cairo_matrix_transform_point	call site: 00285	_cairo_pdf_path_line_to
35	497	_cairo_scaled_font_map_unlock	call site: 00497	_cairo_scaled_font_fini_internal
24	260	_cairo_pdf_operators_end_text	call site: 00260	_cairo_pdf_operators_clip
12	603	_cairo_scaled_font_freeze_cache	call site: 00603	_cairo_validate_text_clusters
10	437	_cairo_pattern_fini	call site: 00437	cairo_device_destroy
9	556	LLVMFuzzerTestOneInput	call site: 00556	_cairo_error
9	676	_cairo_scaled_glyph_lookup	call site: 00676	cairo_scaled_font_text_to_glyphs_internal_uncached
8	575	cairo_show_text	call site: 00575	_cairo_scaled_font_create_in_error
7	653	_cairo_scaled_glyph_lookup	call site: 00653	_cairo_scaled_font_free_last_glyph
7	668	_cairo_scaled_font_thaw_cache	call site: 00668	_cairo_scaled_glyph_page_destroy
7	739	_cairo_ps_surface_create_for_stream_internal	call site: 00739	_cairo_pdf_operators_flush
6	39	_cairo_ft_unscaled_font_init	call site: 00039	_cairo_error

Runtime coverage analysis

Covered functions

783

Functions that are reachable but not covered

104

Reachable functions

304

Percentage of reachable functions covered

65.79%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/font_fuzzer.c	2
cairo/_builddir/..cairo-ft-font.c	12
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-hash.c	10
cairo/_builddir/..cairo-cache.c	8
cairo/_builddir/..cairo-font-face.c	8
cairo/_builddir/..cairo-font-options.c	8
cairo/_builddir/..cairo-array.c	13
cairo/_builddir/..cairo-pdf-surface.c	9
cairo/_builddir/..cairo-output-stream.c	17
cairo/_builddir/..cairo-surface.c	17
cairo/_builddir/..cairo-device.c	5
cairo/_builddir/..cairo-matrix.c	4
cairo/_builddir/..cairo-list-inline.h	7
cairo/_builddir/..cairo-scaled-font-subsets.c	10
cairo/_builddir/..cairo-surface-clipper.c	1
cairo/_builddir/..cairo-pdf-operators.c	23
cairo/_builddir/..cairo-ctype-inline.h	2
cairo/_builddir/..cairo-misc.c	7
cairo/_builddir/..cairoint.h	3
cairo/_builddir/..cairo-path-fixed.c	9
cairo/_builddir/..cairo-fixed-private.h	4
cairo/_builddir/..cairo-pdf-interchange.c	5
cairo/_builddir/..cairo-tag-stack.c	1
cairo/_builddir/..cairo-paginated-surface.c	2
cairo/_builddir/..cairo-recording-surface.c	1
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	2
cairo/_builddir/..cairo-pattern.c	2
cairo/_builddir/..cairo-raster-source-pattern.c	1
cairo/_builddir/..cairo-freed-pool-private.h	1
cairo/_builddir/..cairo-freed-pool.c	1
cairo/_builddir/..cairo-surface-inline.h	1
cairo/_builddir/..cairo-scaled-font.c	21
cairo/_builddir/..cairo-image-compositor.c	3
cairo/_builddir/..cairo.c	14
cairo/_builddir/..cairo-unicode.c	4
cairo/_builddir/..cairo-color.c	2
cairo/_builddir/..cairo-ps-surface.c	5
cairo/_builddir/..cairo-rectangle.c	2
cairo/_builddir/..cairo-image-surface.c	8
cairo/_builddir/..cairo-traps-compositor.c	1
cairo/_builddir/..cairo-shape-mask-compositor.c	1
cairo/_builddir/..cairo-spans-compositor.c	1

Fuzzer: pdf_surface_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	357	60.1%
gold	[1:9]	0	0.0%
yellow	[10:29]	1	0.16%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	236	39.7%
All colors	594	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
95	177	_cairo_output_stream_vprintf	call site: 00177	_cairo_pdf_operators_clip
54	439	cairo_scaled_font_destroy	call site: 00439	_cairo_scaled_font_fini_internal
17	542	cairo_pdf_surface_set_metadata	call site: 00542	iso8601_to_pdf_date_string
15	131	_cairo_pdf_surface_create_for_stream_internal	call site: 00131	_cairo_pdf_operators_flush
14	388	cairo_pattern_destroy	call site: 00388	_cairo_pattern_fini
9	429	_cairo_hash_table_remove	call site: 00429	_cairo_sub_font_destroy
7	27	_cairo_fopen	call site: 00027	_cairo_output_stream_create_in_error
7	279	_cairo_array_index_const	call site: 00279	_cairo_pdf_surface_new_object
7	494	cairo_font_face_destroy	call site: 00494	_cairo_scaled_font_free_recording_surfaces
6	505	cairo_surface_finish	call site: 00505	cairo_surface_destroy
5	325	_cairo_pdf_interchange_set_create_date	call site: 00325	strcat
5	406	cairo_surface_destroy	call site: 00406	_cairo_surface_detach_snapshot

Runtime coverage analysis

Covered functions

305

Functions that are reachable but not covered

112

Reachable functions

221

Percentage of reachable functions covered

49.32%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/pdf_surface_fuzzer.c	1
fuzz/fuzzer_temp_file.h	2
cairo/_builddir/..cairo-pdf-surface.c	13
cairo/_builddir/..cairo-output-stream.c	17
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-misc.c	2
cairo/_builddir/..cairo-surface.c	17
cairo/_builddir/..cairo-device.c	5
cairo/_builddir/..cairo-array.c	13
cairo/_builddir/..cairo-matrix.c	4
cairo/_builddir/..cairo-list-inline.h	5
cairo/_builddir/..cairo-hash.c	7
cairo/_builddir/..cairo-scaled-font-subsets.c	9
cairo/_builddir/..cairo-surface-clipper.c	1
cairo/_builddir/..cairo-pdf-operators.c	23
cairo/_builddir/..cairo-ctype-inline.h	2
cairo/_builddir/..cairoint.h	3
cairo/_builddir/..cairo-path-fixed.c	9
cairo/_builddir/..cairo-fixed-private.h	2
cairo/_builddir/..cairo-pdf-interchange.c	7
cairo/_builddir/..cairo-tag-stack.c	1
cairo/_builddir/..cairo-paginated-surface.c	4
cairo/_builddir/..cairo-recording-surface.c	1
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	2
cairo/_builddir/..cairo-pattern.c	2
cairo/_builddir/..cairo-font-options.c	3
cairo/_builddir/..cairo-raster-source-pattern.c	1
cairo/_builddir/..cairo-freed-pool-private.h	1
cairo/_builddir/..cairo-freed-pool.c	1
cairo/_builddir/..cairo-surface-inline.h	1
cairo/_builddir/..cairo-scaled-font.c	9
cairo/_builddir/..cairo-image-compositor.c	1
cairo/_builddir/..cairo-font-face.c	2
cairo/_builddir/..cairo-unicode.c	4
cairo/_builddir/..cairo.c	6

Fuzzer: multi_surface_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	2462	100.%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	0	0.0%
All colors	2462	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
2461	0	EP	call site: 00000	cairo_svg_surface_create_for_stream

Runtime coverage analysis

Covered functions

0

Functions that are reachable but not covered

754

Reachable functions

754

Percentage of reachable functions covered

0.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/multi_surface_fuzzer.c	2
cairo/_builddir/..cairo-pdf-surface.c	13
cairo/_builddir/..cairo-output-stream.c	21
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-surface.c	38
cairo/_builddir/..cairo-device.c	8
cairo/_builddir/..cairo-array.c	13
cairo/_builddir/..cairo-matrix.c	16
cairo/_builddir/..cairo-list-inline.h	9
cairo/_builddir/..cairo-hash.c	10
cairo/_builddir/..cairo-scaled-font-subsets.c	15
cairo/_builddir/..cairo-surface-clipper.c	2
cairo/_builddir/..cairo-pdf-operators.c	23
cairo/_builddir/..cairo-ctype-inline.h	2
cairo/_builddir/..cairo-misc.c	4
cairo/_builddir/..cairoint.h	7
cairo/_builddir/..cairo-path-fixed.c	40
cairo/_builddir/..cairo-fixed-private.h	14
cairo/_builddir/..cairo-pdf-interchange.c	7
cairo/_builddir/..cairo-tag-stack.c	1
cairo/_builddir/..cairo-paginated-surface.c	5
cairo/_builddir/..cairo-recording-surface.c	20
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	3
cairo/_builddir/..cairo-pattern.c	30
cairo/_builddir/..cairo-font-options.c	7
cairo/_builddir/..cairo-raster-source-pattern.c	3
cairo/_builddir/..cairo-freed-pool-private.h	2
cairo/_builddir/..cairo-freed-pool.c	2
cairo/_builddir/..cairo-surface-inline.h	2
cairo/_builddir/..cairo-scaled-font.c	33
cairo/_builddir/..cairo-image-compositor.c	3
cairo/_builddir/..cairo-font-face.c	3
cairo/_builddir/..cairo-ps-surface.c	5
cairo/_builddir/..cairo-rectangle.c	7
cairo/_builddir/..cairo-svg-surface.c	60
cairo/_builddir/..cairo-color.c	2
cairo/_builddir/..cairo-cache.c	8
cairo/_builddir/..cairo-surface-snapshot-inline.h	2
cairo/_builddir/..cairo-image-info.c	3
cairo/_builddir/..cairo-png.c	11
cairo/_builddir/..cairo-image-surface.c	13
cairo/_builddir/..cairo-traps-compositor.c	1
cairo/_builddir/..cairo-shape-mask-compositor.c	1
cairo/_builddir/..cairo-spans-compositor.c	1
cairo/_builddir/..cairo-recording-surface-inline.h	1
cairo/_builddir/..cairo-surface-wrapper.c	18
cairo/_builddir/..cairo-clip.c	17
cairo/_builddir/..cairo-clip-inline.h	2
cairo/_builddir/..cairo-combsort-inline.h	1
cairo/_builddir/..cairo-analysis-surface-private.h	1
cairo/_builddir/..cairo-clip-boxes.c	6
cairo/_builddir/..cairo-box-inline.h	5
cairo/_builddir/..cairo-boxes.c	9
cairo/_builddir/..cairo-slope-private.h	3
cairo/_builddir/..cairo-path-bounds.c	8
cairo/_builddir/..cairo-spline.c	9
cairo/_builddir/..cairo-path-fixed-private.h	3
cairo/_builddir/..cairo-path-fill.c	12
cairo/_builddir/..cairo-bentley-ottmann-rectangular.c	20
cairo/_builddir/..cairo-traps.c	2
cairo/_builddir/..cairo-polygon.c	8
cairo/_builddir/..cairo-wideint-private.h	1
cairo/_builddir/..cairo-bentley-ottmann-rectilinear.c	14
cairo/_builddir/..cairo-boxes-intersect.c	23
cairo/_builddir/..cairo-analysis-surface.c	2
cairo/_builddir/..cairo-surface-wrapper-private.h	1
cairo/_builddir/..cairo-script-surface.c	27
cairo/_builddir/..cairo-stroke-style.c	1
cairo/_builddir/..cairo-observer.c	1
cairo/_builddir/..cairo.c	17
cairo/_builddir/..cairo-unicode.c	4
fuzz/common_drawing.h	1

Fuzzer: script_interpreter_fuzzer

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	193	32.1%
gold	[1:9]	38	6.33%
yellow	[10:29]	6	1.0%
greenyellow	[30:49]	7	1.16%
lawngreen	50+	356	59.3%
All colors	600	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
64	101	_cairo_pattern_fini	call site: 00101	cairo_scaled_font_destroy
27	170	_cairo_array_allocate	call site: 00170	_cairo_scaled_font_free_recording_surfaces
11	78	_freed_pool_put	call site: 00078	cairo_device_destroy
7	31	csi_dictionary_put	call site: 00031	cairo_font_face_destroy
7	52	_cairo_surface_has_snapshots	call site: 00052	_cairo_surface_detach_snapshot
6	67	_cairo_surface_finish	call site: 00067	_cairo_damage_destroy
6	572	_scan_file	call site: 00572	_csi_string_execute
3	60	cairo_surface_destroy	call site: 00060	_cairo_surface_set_error
3	234	csi_dictionary_put	call site: 00234	cairo_reference
3	239	cairo_pattern_reference	call site: 00239	cairo_scaled_font_reference
3	301	_csi_push_ostack_copy	call site: 00301	_csi_array_execute
2	96	_cairo_surface_detach_mime_data	call site: 00096	_cairo_user_data_array_fini

Runtime coverage analysis

Covered functions

371

Functions that are reachable but not covered

67

Reachable functions

195

Percentage of reachable functions covered

65.64%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
fuzz/script_interpreter_fuzzer.c	1
cairo/_builddir/../util/cairo-script/cairo-script-interpreter.c	26
cairo/_builddir/../util/cairo-script/cairo-script-hash.c	9
cairo/_builddir/../util/cairo-script/cairo-script-stack.c	5
cairo/_builddir/../util/cairo-script/cairo-script-objects.c	20
cairo/_builddir/../util/cairo-script/cairo-script-private.h	4
cairo/_builddir/..cairo.c	2
cairo/_builddir/..cairo-font-face.c	3
cairo/_builddir/..cairo-array.c	13
cairo/_builddir/..cairo-pattern.c	3
cairo/_builddir/..cairo-surface.c	12
cairo/_builddir/..cairo-list-inline.h	5
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	2
cairo/_builddir/..cairo-freed-pool-private.h	1
cairo/_builddir/..cairo-freed-pool.c	1
cairo/_builddir/..cairo-device.c	4
cairo/_builddir/..cairo-font-options.c	3
cairo/_builddir/..cairo-surface-inline.h	1
cairo/_builddir/..cairo-raster-source-pattern.c	1
cairo/_builddir/..cairo-scaled-font.c	10
cairo/_builddir/..cairo-hash.c	6
cairo/_builddir/..cairo-image-compositor.c	1
cairo/_builddir/..cairo-path-fixed.c	3
cairo/_builddir/../util/cairo-script/cairo-script-file.c	8
cairo/_builddir/../util/cairo-script/cairo-script-operators.c	3
cairo/_builddir/../util/cairo-script/cairo-script-scanner.c	28
/usr/include/x86_64-linux-gnu/bits/byteswap.h	2

Fuzzer: cairo/meson-cc-tests/fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	0	0.0%
gold	[1:9]	0	0.0%
yellow	[10:29]	0	0.0%
greenyellow	[30:49]	0	0.0%
lawngreen	50+	1	100.%
All colors	1	100

Runtime coverage analysis

Covered functions

1899

Functions that are reachable but not covered

0

Reachable functions

1

Percentage of reachable functions covered

100.0%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
cairo/meson-cc-tests/fuzzer.c	1

Fuzzer: cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c

Call tree

The calltree shows the control flow of the fuzzer. This is overlaid with coverage information to display how much of the potential code a fuzzer can reach is in fact covered at runtime. In the following there is a link to a detailed calltree visualisation as well as a bitmap showing a high-level view of the calltree. For further information about these topics please see the glossary for full calltree and calltree overview

Call tree overview bitmap:

The distribution of callsites in terms of coloring is

Color	Runtime hitcount	Callsite count	Percentage
red	0	700	39.9%
gold	[1:9]	128	7.29%
yellow	[10:29]	23	1.31%
greenyellow	[30:49]	3	0.17%
lawngreen	50+	900	51.3%
All colors	1754	100

Fuzz blockers

The following nodes represent call sites where fuzz blockers occur.

Amount of callsites blocked	Calltree index	Parent function	Callsite	Largest blocked function
41	608	_cairo_box_from_rectangle	call site: 00608	_cairo_recording_surface_create_bbtree
37	1486	cairo_scaled_font_destroy	call site: 01486	_cairo_scaled_font_fini_internal
36	1225	_gradient_is_clear	call site: 01225	_cairo_gradient_pattern_box_to_parameter
35	1344	_cairo_surface_stroke	call site: 01344	_cairo_surface_wrapper_fill_stroke
26	1173	_cairo_clip_intersect_path	call site: 01173	_cairo_clip_intersect_clip_path_transformed
23	1038	_cairo_path_fixed_fill_to_polygon	call site: 01038	_cairo_filler_ra_move_to
18	1321	_cairo_surface_wrapper_mask	call site: 01321	_cairo_surface_wrapper_stroke
16	1416	cairo_font_options_merge	call site: 01416	cairo_scaled_font_create
13	242	parse_svg	call site: 00242	append_attribute
13	1548	_cairo_scaled_font_fini_key	call site: 01548	cairo_scaled_font_destroy
13	1666	_cairo_scaled_glyph_lookup	call site: 01666	composite_one_color_glyph
12	165	parse_svg	call site: 00165	_cairo_isspace

Runtime coverage analysis

Covered functions

1899

Functions that are reachable but not covered

123

Reachable functions

562

Percentage of reachable functions covered

78.11%

NB: The sum of covered functions and functions that are reachable but not covered need not be equal to Reachable functions . This is because the reachability analysis is an approximation and thus at runtime some functions may be covered that are not included in the reachability analysis. This is a limitation of our static analysis capabilities.

Warning: The number of covered functions are larger than the number of reachable functions. This means that there are more functions covered at runtime than are extracted using static analysis. This is likely a result of the static analysis component failing to extract the right call graph or the coverage runtime being compiled with sanitizers in code that the static analysis has not analysed. This can happen if lto/gold is not used in all places that coverage instrumentation is used.

Function name	source code lines	source lines hit	percentage hit

Files reached

filename	functions hit
cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c	1
cairo/_builddir/..cairo-image-surface.c	10
cairo/_builddir/..cairo-error.c	1
cairo/_builddir/..cairo-surface.c	31
cairo/_builddir/..cairo-device.c	5
cairo/_builddir/..cairo-array.c	13
cairo/_builddir/..cairo-matrix.c	19
cairo/_builddir/..cairo-list-inline.h	7
cairo/_builddir/..cairo-image-compositor.c	3
cairo/_builddir/..cairo-traps-compositor.c	1
cairo/_builddir/..cairo-shape-mask-compositor.c	1
cairo/_builddir/..cairo-spans-compositor.c	1
cairo/_builddir/..cairo.c	15
cairo/_builddir/..cairo-svg-glyph-render.c	41
cairo/_builddir/..cairo-pattern.c	32
cairo/_builddir/..cairo-color.c	2
cairo/_builddir/..cairo-freed-pool-private.h	2
cairo/_builddir/..cairo-freed-pool.c	2
cairo/_builddir/..cairo-hash.c	9
cairo/_builddir/..cairo-ctype-inline.h	1
cairo/_builddir/..cairo-cache.c	8
cairo/_builddir/..cairo-damage.c	1
cairo/_builddir/..cairo-region.c	4
cairo/_builddir/..cairo-font-options.c	7
cairo/_builddir/..cairo-surface-inline.h	2
cairo/_builddir/..cairo-raster-source-pattern.c	3
cairo/_builddir/..cairo-misc.c	4
cairo/_builddir/..cairo-recording-surface.c	22
cairo/_builddir/..cairo-path.c	1
cairo/_builddir/..cairo-recording-surface-inline.h	1
cairo/_builddir/..cairo-analysis-surface.c	6
cairo/_builddir/..cairoint.h	7
cairo/_builddir/..cairo-surface-wrapper.c	18
cairo/_builddir/..cairo-rectangle.c	7
cairo/_builddir/..cairo-clip.c	17
cairo/_builddir/..cairo-clip-inline.h	2
cairo/_builddir/..cairo-fixed-private.h	14
cairo/_builddir/..cairo-combsort-inline.h	1
cairo/_builddir/..cairo-analysis-surface-private.h	1
cairo/_builddir/..cairo-path-fixed.c	38
cairo/_builddir/..cairo-clip-boxes.c	6
cairo/_builddir/..cairo-box-inline.h	5
cairo/_builddir/..cairo-boxes.c	9
cairo/_builddir/..cairo-slope-private.h	3
cairo/_builddir/..cairo-path-bounds.c	8
cairo/_builddir/..cairo-spline.c	9
cairo/_builddir/..cairo-path-fixed-private.h	2
cairo/_builddir/..cairo-path-fill.c	12
cairo/_builddir/..cairo-bentley-ottmann-rectangular.c	20
cairo/_builddir/..cairo-traps.c	2
cairo/_builddir/..cairo-polygon.c	8
cairo/_builddir/..cairo-wideint-private.h	1
cairo/_builddir/..cairo-bentley-ottmann-rectilinear.c	14
cairo/_builddir/..cairo-boxes-intersect.c	23
cairo/_builddir/..cairo-surface-snapshot-inline.h	2
cairo/_builddir/..cairo-surface-wrapper-private.h	1
cairo/_builddir/..cairo-scaled-font.c	33
cairo/_builddir/..cairo-font-face.c	3

Optimal target analysis

Remaining optimal interesting functions

The following table shows a list of functions that are optimal targets. Optimal targets are identified by finding the functions that in combination, yield a high code coverage.

Func name	Functions filename	Arg count	Args	Function depth	hitcount	instr count	bb count	cyclomatic complexity	Reachable functions	Incoming references	total cyclomatic complexity	Unreached complexity
_cairo_pdf_surface_finish	/src/cairo/_builddir/../src/cairo-pdf-surface.c	1	['N/A']	29	0	602	81	30	989	0	6462	3151
_cairo_traps_compositor_stroke	/src/cairo/_builddir/../src/cairo-traps-compositor.c	8	['N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'double', 'int']	26	0	290	44	17	703	0	4449	1613
_cairo_ft_scaled_glyph_init	/src/cairo/_builddir/../src/cairo-ft-font.c	4	['N/A', 'N/A', 'int', 'N/A']	28	0	450	75	28	757	0	4285	857
_cairo_ps_surface_fill	/src/cairo/_builddir/../src/cairo-ps-surface.c	8	['N/A', 'int', 'N/A', 'N/A', 'int', 'double', 'int', 'N/A']	24	0	199	27	11	667	0	4070	658
span_renderer_init	/src/cairo/_builddir/../src/cairo-image-compositor.c	4	['N/A', 'N/A', 'int', 'int']	24	0	456	49	20	547	0	3350	482
_cairo_script_surface_show_text_glyphs	/src/cairo/_builddir/../src/cairo-script-surface.c	12	['N/A', 'int', 'N/A', 'N/A', 'int', 'N/A', 'int', 'N/A', 'int', 'int', 'N/A', 'N/A']	30	0	901	118	42	618	0	3589	437
_font	/src/cairo/_builddir/../util/cairo-script/cairo-script-operators.c	1	['N/A']	19	0	158	24	8	320	0	1674	342

Implementing fuzzers that target the above functions will improve reachability such that it becomes:

Functions statically reachable by fuzzers

1968 / 3511

Cyclomatic complexity statically reachable by fuzzers

13023 / 21266

All functions overview

If you implement fuzzers for these functions, the status of all functions in the project will be:

Func name	Functions filename	Args	Function call depth	Reached by Fuzzers	Runtime reached by Fuzzers	Combined reached by Fuzzers	Fuzzers runtime hit	Func lines hit %	I Count	BB Count	Cyclomatic complexity	Functions reached	Reached by functions	Accumulated cyclomatic complexity	Undiscovered complexity

This sections provides heuristics that can be used as input to a fuzz engine when running a given fuzz target. The current focus is on providing input that is usable by libFuzzer.

fuzz/raster_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

fuzz/surface_write_png_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cairo_surface_destroy', 'cairo_format_stride_for_width', '_cairo_surface_has_snapshots', '_cairo_image_surface_coerce_to_format', '_cairo_surface_finish', '_cairo_error', '_cairo_hash_table_insert', 'cairo_image_surface_create_for_data', 'cairo_surface_write_to_png']

fuzz/text_glyphs_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_cairo_utf8_to_ucs4', 'cairo_surface_reference', 'cairo_pattern_destroy', 'cairo_text_extents', 'LLVMFuzzerTestOneInput', 'cairo_format_stride_for_width', '_cairo_surface_finish', '_cairo_error', 'cairo_surface_destroy']

cairo/test/svg/fuzzer/svg-render-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cairo_surface_finish', '_cairo_font_options_init_copy', '_cairo_box_from_rectangle', 'cairo_scaled_font_destroy', '_gradient_is_clear', '_cairo_recording_surface_replay_internal', '_cairo_clip_intersect_path', '_cairo_path_fixed_fill_to_polygon', 'cairo_pattern_set_matrix', '_cairo_surface_wrapper_mask']

fuzz/font_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['cairo_matrix_transform_point', '_cairo_scaled_font_map_unlock', '_cairo_pdf_operators_end_text', '_cairo_scaled_font_freeze_cache', '_cairo_pattern_fini', 'LLVMFuzzerTestOneInput', '_cairo_scaled_glyph_lookup', 'cairo_show_text', '_cairo_scaled_font_thaw_cache']

fuzz/pdf_surface_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_cairo_output_stream_vprintf', 'cairo_scaled_font_destroy', 'cairo_pdf_surface_set_metadata', '_cairo_pdf_surface_create_for_stream_internal', 'cairo_pattern_destroy', '_cairo_hash_table_remove', '_cairo_fopen', '_cairo_array_index_const', 'cairo_font_face_destroy', 'cairo_surface_finish']

fuzz/multi_surface_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

fuzz/script_interpreter_fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_cairo_pattern_fini', '_cairo_array_allocate', '_freed_pool_put', 'csi_dictionary_put', '_cairo_surface_has_snapshots', '_cairo_surface_finish', '_scan_file', 'cairo_surface_destroy', 'cairo_pattern_reference']

cairo/meson-cc-tests/fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c

Dictionary

Use this with the libFuzzer -dict=DICT.file flag

Fuzzer function priority

Use one of these functions as input to libfuzzer with flag: -focus_function name

-focus_function=['_cairo_box_from_rectangle', 'cairo_scaled_font_destroy', '_gradient_is_clear', '_cairo_surface_stroke', '_cairo_clip_intersect_path', '_cairo_path_fixed_fill_to_polygon', '_cairo_surface_wrapper_mask', 'cairo_font_options_merge', 'parse_svg', '_cairo_scaled_font_fini_key']

This section shows analysis of runtime coverage data.

For futher technical details on how this section is generated, please see the Glossary .

Complex functions with low coverage

Func name	Function total lines	Lines covered at runtime	percentage covered	Reached by fuzzers
_cairo_user_data_array_set_data	38	19	50.0%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'text_glyphs_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'surface_write_png_fuzzer', 'raster_fuzzer']
_cairo_format_from_pixman_format	45	14	31.11%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', 'text_glyphs_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'surface_write_png_fuzzer', 'raster_fuzzer', 'multi_surface_fuzzer']
_cairo_image_compute_transparency	42	19	45.23%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'surface_write_png_fuzzer', 'multi_surface_fuzzer']
_cairo_surface_create_in_error	70	15	21.42%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', 'text_glyphs_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'surface_write_png_fuzzer', 'raster_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']
cairo_font_options_merge	43	19	44.18%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', 'text_glyphs_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'multi_surface_fuzzer']
_cairo_ft_options_merge	76	30	39.47%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', 'text_glyphs_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_ft_font_options_substitute	105	8	7.619%	['/src/cairo/meson-cc-tests/fuzzer.c', 'text_glyphs_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_scaled_font_text_to_glyphs	143	57	39.86%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', 'text_glyphs_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_show_text_glyphs	44	4	9.090%	['/src/cairo/meson-cc-tests/fuzzer.c', 'text_glyphs_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_analyze_recording_surface_pattern	124	64	51.61%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_boxes_intersect_with_box	38	19	50.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'multi_surface_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_clip_reduce_to_boxes	35	5	14.28%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_clip_copy_with_translation	35	7	20.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_composite_rectangles_intersect_mask_extents	48	19	39.58%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_reduce_op	33	7	21.21%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
color_to_pixel	37	11	29.72%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_pixman_operator	65	6	9.230%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
span_renderer_init	103	18	17.47%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
mono_renderer_init	64	4	6.25%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_fill_xrgb32_lerp_opaque_spans	63	27	42.85%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_blit_xrgb32_lerp_spans	55	28	50.90%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_inplace_spans	66	33	50.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_pixman_image_for_surface	144	56	38.88%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_pixel_to_solid	83	21	25.30%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_path_fixed_add	48	14	29.16%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'multi_surface_fuzzer']
_tessellate_fan	116	61	52.58%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_stroker_add_cap	58	19	32.75%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pattern_init_copy	50	23	46.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_gradient_is_opaque	32	15	46.87%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'multi_surface_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_gradient_is_clear	41	17	41.46%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'multi_surface_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_recording_surface_copy__fill	32	17	53.12%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_recording_surface_replay_internal	278	149	53.59%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']
generate	76	34	44.73%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_surface_wrapper_get_target_extents	45	18	40.0%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']
parse_error	31	7	22.58%	['/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_cff_subset_init	59	9	15.25%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_cff_scaled_font_is_cid_cff	82	29	35.36%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_cff_font_create	84	25	29.76%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_cff_font_load_opentype_cff	59	12	20.33%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_cff_font_destroy	54	24	44.44%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_ft_scaled_glyph_init_metrics	93	51	54.83%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_ft_scaled_glyph_get_metrics	58	21	36.20%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_compute_xrender_bitmap_size	46	20	43.47%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_fill_xrender_bitmap	128	24	18.75%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_get_bitmap_surface	151	38	25.16%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_ft_load_type1_data	42	18	42.85%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_ft_apply_variations	70	33	47.14%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_gstate_transform_glyphs_to_backend	172	62	36.04%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pattern_alpha_range	51	12	23.52%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_pdf_interchange_write_outline	80	9	11.25%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_pdf_interchange_write_page_labels	66	16	24.24%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_interchange_write_document_dests	56	9	16.07%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_clear	50	25	50.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_write_patterns_and_smask_groups	45	17	37.77%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_add_pdf_pattern_or_shading	64	11	17.18%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_select_pattern	76	41	53.94%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_emit_group_resources	92	47	51.08%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_open_content_stream	74	23	31.08%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_write_page	72	20	27.77%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_analyze_operation	57	7	12.28%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_surface_show_text_glyphs	137	58	42.33%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_ps_surface_analyze_operation	49	13	26.53%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_ps_surface_emit_pattern	51	14	27.45%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_recording_surface_merge_source_attributes	46	6	13.04%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'multi_surface_fuzzer']
cairo_region_create_rectangles	38	15	39.47%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_surface_wrapper_show_text_glyphs	76	32	42.10%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'multi_surface_fuzzer']
_cairo_surface_show_text_glyphs	95	52	54.73%	['/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c', 'font_fuzzer', '/src/cairo/meson-cc-tests/fuzzer.c', 'svg-render-fuzzer', 'multi_surface_fuzzer']
_cairo_type1_subset_init	63	21	33.33%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_type1_font_subset_generate	34	10	29.41%	['/src/cairo/meson-cc-tests/fuzzer.c', 'font_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_pdf_interchange_set_metadata	46	21	45.65%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_pdf_interchange_write_annot	66	12	18.18%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_pdf_interchange_write_node_object	108	30	27.77%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_extract_pdf_surface	34	13	38.23%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_cairo_tag_parse_link_attributes	106	27	25.47%	['/src/cairo/meson-cc-tests/fuzzer.c', 'pdf_surface_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_mesh_pattern_end_patch	40	12	30.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_mesh_pattern_curve_to	42	8	19.04%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
cairo_mesh_pattern_line_to	34	14	41.17%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
csi_file_getc	32	16	50.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
csi_file_read	40	18	45.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_context	35	11	31.42%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_font	50	14	28.00%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_for	31	8	25.80%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_get	53	19	35.84%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_glyph_path	45	13	28.88%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_image_load_from_dictionary	71	10	14.08%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_map_to_image	32	13	40.62%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_scale	35	19	54.28%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_scaled_font	41	19	46.34%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_set	44	22	50.0%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_set_dash	47	15	31.91%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_set_mime_data	48	15	31.25%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_set_source_image	36	8	22.22%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_show_glyphs	45	10	22.22%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_show_text_glyphs	101	22	21.78%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_similar	43	19	44.18%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_surface	144	18	12.5%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']
_csi_stack_roll	43	22	51.16%	['/src/cairo/meson-cc-tests/fuzzer.c', 'script_interpreter_fuzzer', '/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']

This section shows which files and directories are considered in this report. The main reason for showing this is fuzz introspector may include more code in the reasoning than is desired. This section helps identify if too many files/directories are included, e.g. third party code, which may be irrelevant for the threat model. In the event too much is included, fuzz introspector supports a configuration file that can exclude data from the report. See the following link for more information on how to create a config file: link

Files in report

Source file	Reached by	Covered by
	[]	[]
/src/cairo/_builddir/../src/cairo-analysis-surface-private.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-rectangle.c	['svg-render-fuzzer', 'font_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-no-compositor.c	[]	[]
/src/cairo/_builddir/../util/cairo-script/cairo-script-objects.c	['script_interpreter_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-ft-font.c	['font_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-hull.c	[]	[]
/src/fuzz/pdf_surface_fuzzer.c	['pdf_surface_fuzzer']	['pdf_surface_fuzzer']
/src/cairo/_builddir/../src/cairo-script-surface.c	['multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-traps-compositor.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-boxes.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-mesh-pattern-rasterizer.c	[]	[]
/src/cairo/_builddir/../src/cairo-type1-subset.c	[]	[]
/src/cairo/_builddir/../src/cairo-backend-private.h	[]	[]
/src/cairo/_builddir/../src/cairo-stroke-dash.c	[]	[]
/usr/include/x86_64-linux-gnu/bits/byteswap.h	['script_interpreter_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-gstate-private.h	[]	[]
/src/cairo/_builddir/../src/cairo-tor22-scan-converter.c	[]	[]
/src/cairo/_builddir/../src/cairo-image-compositor.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../util/cairo-script/cairo-script-private.h	['script_interpreter_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-analysis-surface.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-recording-surface.c	['svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-color.c	['raster_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-pattern-inline.h	[]	[]
/src/fuzz/script_interpreter_fuzzer.c	['script_interpreter_fuzzer']	['script_interpreter_fuzzer']
/src/cairo/_builddir/../util/cairo-script/cairo-script-file.c	['script_interpreter_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-bentley-ottmann.c	[]	[]
/src/cairo/_builddir/../src/cairo-pdf-interchange.c	['font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../util/cairo-script/cairo-script-operators.c	['script_interpreter_fuzzer']	[]
/src/cairo/_builddir/../util/cairo-script/cairo-script-scanner.c	['script_interpreter_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-path-in-fill.c	[]	[]
/src/cairo/_builddir/../src/cairo-path-stroke.c	[]	[]
/src/cairo/_builddir/../util/cairo-script/cairo-script-hash.c	['script_interpreter_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-fixed-private.h	['svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-surface-offset.c	[]	[]
/src/cairo/_builddir/../src/cairo-surface-subsurface-inline.h	[]	[]
/src/cairo/_builddir/../src/cairo-scaled-font-subsets.c	['font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-composite-rectangles.c	[]	[]
/src/cairo/_builddir/../src/cairo-default-context.c	[]	[]
/src/cairo/_builddir/../src/cairo-slope.c	[]	[]
/src/cairo/_builddir/../src/cairo-combsort-inline.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/fuzz/fuzzer_temp_file.h	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'pdf_surface_fuzzer']	['surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'pdf_surface_fuzzer']
/src/cairo/_builddir/../src/cairo-surface-snapshot.c	[]	[]
/src/fuzz/font_fuzzer.c	['font_fuzzer']	['font_fuzzer']
/src/cairo/_builddir/../src/cairo-user-font.c	[]	[]
/src/cairo/_builddir/../src/cairo-tor-scan-converter.c	[]	[]
/src/cairo/_builddir/../src/cairo-ctype-inline.h	['svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-svg-glyph-render.c	['svg-render-fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-pdf-surface.c	['font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-shape-mask-compositor.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-clip-inline.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c	['cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	['svg-render-fuzzer']
/src/cairo/_builddir/../src/cairo-damage.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-pen.c	[]	[]
/src/cairo/_builddir/../src/cairo-bentley-ottmann-rectilinear.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-version.c	[]	[]
/src/cairo/_builddir/../src/cairo-clip-region.c	[]	[]
/src/cairo/_builddir/../src/cairo-compositor.c	[]	[]
/src/cairo/_builddir/../src/cairo-wideint.c	[]	[]
/src/cairo/_builddir/../src/cairo-line-inline.h	[]	[]
/src/cairo/_builddir/../src/cairo-arc.c	[]	[]
/src/cairo/_builddir/../src/cairo-matrix.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-path.c	['svg-render-fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../util/cairo-script/cairo-script-stack.c	['script_interpreter_fuzzer']	[]
/src/cairo/test/svg/fuzzer/svg-render-fuzzer.c	['svg-render-fuzzer']	['svg-render-fuzzer']
/src/cairo/_builddir/../src/cairo-output-stream.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-cff-subset.c	[]	[]
/src/cairo/_builddir/../src/cairo-debug.c	[]	[]
/src/cairo/_builddir/../src/cairo-surface-inline.h	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-hash.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-cache.c	['text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-scaled-font.c	['text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-toy-font-face.c	[]	[]
/src/cairo/_builddir/../src/cairo-paginated-surface.c	['font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-pdf-operators.c	['font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-freed-pool-private.h	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-path-stroke-polygon.c	[]	[]
/src/cairo/_builddir/../src/cairo-gstate.c	[]	[]
/src/cairo/_builddir/../src/cairo-unicode.c	['text_glyphs_fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-clip-polygon.c	[]	[]
/src/cairo/_builddir/../src/cairo-list-inline.h	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-surface-wrapper-private.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-spline.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-path-fill.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-freed-pool.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-clip-surface.c	[]	[]
/src/cairo/_builddir/../src/cairo-font-face-twin.c	[]	[]
/src/cairo/_builddir/../src/cairo-type1-fallback.c	[]	[]
/src/fuzz/common_drawing.h	['multi_surface_fuzzer']	[]
/src/cairo/meson-cc-tests/fuzzer.c	['cairo/meson-cc-tests/fuzzer.c']	['cairo/meson-cc-tests/fuzzer.c']
/src/cairo/_builddir/../src/cairo-polygon-intersect.c	[]	[]
/src/cairo/_builddir/../src/cairo-base85-stream.c	[]	[]
/src/cairo/_builddir/../src/cairo-colr-glyph-render.c	[]	[]
/src/cairo/_builddir/../src/cairo-path-bounds.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-freelist.c	[]	[]
/src/cairo/_builddir/../src/cairo-tag-stack.c	['font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-spans.c	[]	[]
/src/cairo/_builddir/../src/cairo-ps-surface.c	['font_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-font-options.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-observer.c	['multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-polygon.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-boxes-intersect.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-device.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-box-inline.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-error.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-contour-inline.h	[]	[]
/src/cairo/_builddir/../src/cairo-region.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-tag-attributes.c	[]	[]
/src/cairo/_builddir/../src/cairo-surface-subsurface.c	[]	[]
/src/cairo/_builddir/../src/cairo-stroke-style.c	['multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-polygon-reduce.c	[]	[]
/src/cairo/_builddir/../src/cairo-svg-surface.c	['multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-raster-source-pattern.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-path-fixed.c	['text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-lzw.c	[]	[]
/src/fuzz/text_glyphs_fuzzer.c	['text_glyphs_fuzzer']	['text_glyphs_fuzzer']
/src/cairo/_builddir/../src/cairo-freelist-private.h	[]	[]
/src/cairo/_builddir/../src/cairo-truetype-subset.c	[]	[]
/src/cairo/_builddir/../src/cairo-path-fixed-private.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-misc.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-slope-private.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../util/cairo-script/cairo-script-interpreter.c	['script_interpreter_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-tristrip.c	[]	[]
/src/cairo/_builddir/../src/cairo-image-source.c	[]	[]
/src/fuzz/raster_fuzzer.c	['raster_fuzzer']	[]
/src/cairo/_builddir/../src/cairo.c	['raster_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-pdf-shading.c	[]	[]
/src/cairo/_builddir/../src/cairo-rectangular-scan-converter.c	[]	[]
/src/cairo/_builddir/../src/cairo-type3-glyph-surface.c	[]	[]
/src/cairo/_builddir/../src/cairo-png.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-wideint-private.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-path-stroke-tristrip.c	[]	[]
/src/cairo/_builddir/../src/cairo-surface-wrapper.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-deflate-stream.c	[]	[]
/src/cairo/_builddir/../src/cairo-mono-scan-converter.c	[]	[]
/src/cairo/_builddir/../src/cairo-image-surface-inline.h	['raster_fuzzer', 'surface_write_png_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-pattern.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-clip.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-line.c	[]	[]
/src/cairo/_builddir/../src/cairoint.h	['svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-font-face.c	['svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-recording-surface-inline.h	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-mask-compositor.c	[]	[]
/src/cairo/_builddir/../src/cairo-contour.c	[]	[]
/src/fuzz/multi_surface_fuzzer.c	['multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-spans-compositor.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-surface-clipper.c	['font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-type1-glyph-names.c	[]	[]
/src/cairo/_builddir/../src/cairo-path-stroke-boxes.c	[]	[]
/src/cairo/_builddir/../src/cairo-image-info.c	['multi_surface_fuzzer']	[]
/src/cairo/_builddir/../src/cairo-surface-snapshot-inline.h	['surface_write_png_fuzzer', 'svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/fuzz/surface_write_png_fuzzer.c	['surface_write_png_fuzzer']	['surface_write_png_fuzzer']
/src/cairo/_builddir/../src/cairo-path-stroke-traps.c	[]	[]
/src/cairo/_builddir/../src/cairo-array.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-clip-boxes.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-bentley-ottmann-rectangular.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-image-surface.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-surface.c	['raster_fuzzer', 'surface_write_png_fuzzer', 'text_glyphs_fuzzer', 'svg-render-fuzzer', 'font_fuzzer', 'pdf_surface_fuzzer', 'multi_surface_fuzzer', 'script_interpreter_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]
/src/cairo/_builddir/../src/cairo-traps.c	['svg-render-fuzzer', 'multi_surface_fuzzer', 'cairo/_builddir/../test/svg/fuzzer/svg-render-fuzzer.c']	[]

Directories in report

Directory
/src/cairo/_builddir/../test/svg/fuzzer/
/src/fuzz/
/src/cairo/_builddir/../util/cairo-script/
/usr/include/x86_64-linux-gnu/bits/
/src/cairo/meson-cc-tests/
/src/cairo/_builddir/../src/
/src/cairo/test/svg/fuzzer/